diff --git a/src/fastmcp/server/auth/providers/azure.py b/src/fastmcp/server/auth/providers/azure.py index cd1de2c4a..3caa2b085 100644 --- a/src/fastmcp/server/auth/providers/azure.py +++ b/src/fastmcp/server/auth/providers/azure.py @@ -220,7 +220,7 @@ class AzureProvider(OAuthProxy): token_verifier = JWTVerifier( jwks_uri=jwks_uri, issuer=issuer, - audience=client_id, + audience=self.identifier_uri, algorithm="RS256", required_scopes=validation_scopes, # Only validate non-OIDC scopes http_client=http_client, @@ -627,7 +627,7 @@ class AzureJWTVerifier(JWTVerifier): super().__init__( jwks_uri=f"https://{base_authority}/{tenant_id}/discovery/v2.0/keys", issuer=issuer, - audience=client_id, + audience=self._identifier_uri, algorithm="RS256", required_scopes=required_scopes, ) diff --git a/tests/server/auth/providers/test_azure.py b/tests/server/auth/providers/test_azure.py index d83bc8860..3bde8ead8 100644 --- a/tests/server/auth/providers/test_azure.py +++ b/tests/server/auth/providers/test_azure.py @@ -211,7 +211,7 @@ class TestAzureProvider: "https://login.microsoftonline.com/my-tenant/discovery/v2.0/keys" ) assert verifier.issuer == "https://login.microsoftonline.com/my-tenant/v2.0" - assert verifier.audience == "test_client" + assert verifier.audience == "api://my-api" # Scopes are stored unprefixed for token validation # (Azure returns unprefixed scopes like ".default" in JWT tokens) assert verifier.required_scopes == [".default"] diff --git a/tests/server/auth/providers/test_azure_scopes.py b/tests/server/auth/providers/test_azure_scopes.py index edbfa3165..beaeb8b8e 100644 --- a/tests/server/auth/providers/test_azure_scopes.py +++ b/tests/server/auth/providers/test_azure_scopes.py @@ -413,7 +413,7 @@ class TestAzureJWTVerifier: == "https://login.microsoftonline.com/my-tenant-id/discovery/v2.0/keys" ) assert verifier.issuer == "https://login.microsoftonline.com/my-tenant-id/v2.0" - assert verifier.audience == "my-client-id" + assert verifier.audience == "api://my-client-id" assert verifier.algorithm == "RS256" assert verifier.required_scopes == ["access_as_user"] @@ -431,7 +431,7 @@ class TestAzureJWTVerifier: token = key_pair.create_token( subject="test-user", issuer="https://login.microsoftonline.com/my-tenant-id/v2.0", - audience="my-client-id", + audience="api://my-client-id", additional_claims={"scp": "access_as_user"}, ) result = await verifier.load_access_token(token)